f79a7b6bc3737c5d31d0289d7a80e9e792c98ca219e20909fc17d49f3a3dac72

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 23:53

Target

f79a7b6bc3737c5d31d0289d7a80e9e792c98ca219e20909fc17d49f3a3dac72.dll
Size

32KB
MD5

08b5ddf888e2cd448f7380899e6f331c
SHA1

1382fb1eac846685a781c06f0c25fb448cf01d10
SHA256

f79a7b6bc3737c5d31d0289d7a80e9e792c98ca219e20909fc17d49f3a3dac72
SHA512

8172a114be5c483a069ecd739c2f473dcee017e43970dd87ea1974292d567433312c25d72fb031dfadfea7c2dc7ef25636b288c64387ba48dc2235d0689c0746
SSDEEP

768:+2Pr8feR1Geasryxdy7pF6ozhZflIRv1qqm:+2Pr8feCezB7p8gDNIRNqv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26
PID 1456 wrote to memory of 1524	1456	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f79a7b6bc3737c5d31d0289d7a80e9e792c98ca219e20909fc17d49f3a3dac72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f79a7b6bc3737c5d31d0289d7a80e9e792c98ca219e20909fc17d49f3a3dac72.dll,#1
  2⤵
  PID:1524

memory/1524-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download